Privacy policy

This Privacy Policy describes how we, The King’s Cross Group LP acting by its general partner The King’s Cross Group GP Limited collect and process personal information about you in relation to your use of our website and app, access to the King’s Cross Estate (including shops, restaurants and buildings on the King’s Cross Estate) and our services. Unless specified otherwise, when collecting the data specified in this Privacy Policy, The King’s Cross Group LP are the data controllers.

References in this Privacy Policy to the “King’s Cross Estate” shall be understood to mean the following areas at King’s Cross: Granary Square, Handyside Gardens and Lewis Cubitt Park, St Pancras Square, Gasholder Park, Bagley Walk, Chilton Square, Coal Drops Yard, Keskidee Square, Gatti Park, Jellicoe Gardens, Battle Bridge Place, as all access roads, bridges and public pathways that serve King’s Cross and any other buildings, squares or other areas which form part of King’s Cross Estate from time to time.

We ask that you read this Privacy Policy carefully as it contains important information on who we are, how and why we collect, store, use and share personal information, your rights in relation to your personal information and on how to contact us and supervisory authorities in the event you have a complaint.

‍

Personal information we collect about you

Personal information is information, or a combination of pieces of information, from which a living person can be identified.

We may collect information about you in the following ways:

• Through your interactions with us. You may give us your personal information when you purchase products or services via our website, sign up for a newsletter, fill out a feedback form, complete a ‘contact us’ form, report a problem with our website or contact us by email.
• From third parties and other sources. We may work closely with third parties (including, for example, business partners and other third parties we collaborate with) and may receive information about you from them. We may also receive information about you from other third parties, including victims and witnesses, if a crime, accident, offence or parking violation has taken place on the King’s Cross Estate.
• From our cameras, including CCTV and Body Worn Video cameras. When you visit the King’s Cross Estate, your personal data may be captured in the following ways:
  
  • By our CCTV cameras and systems;
  • By Body Worn Video (“BWV”) cameras worn by our security staff who operate on the King’s Cross Estate;
  • By our photographers who are appointed by us to take pictures of individuals who visit the King’s Cross Estate;
  • By our drones, although please note that we only use drones for purposes of carrying out site surveys and digital mapping of the King’s Cross Estate from time to time; and
  • We also collect statistical non-personal information on the footfall (i.e. number of visits) to the King’s Cross Estate. This data is collected by us from footfall counters and CCTV cameras.

• Through automated technologies or interactions. When you visit our website the web server collects some basic information about your computer such as your IP address, operating system and browser type. Our website also uses cookies to distinguish you from other users of our website and to promote a good experience when you browse our website. Details of cookies that we use on our websites can be found in our Cookie Policy;

‍

The personal information we collect about you depends on the particular activities carried out. Such information includes:

• Your name, email address, residential address and telephone number;
• Your image;
• Date of birth;
• Details of any feedback you give us by phone, email, post or via social media;
• Information about the services we provide to you;
• Your account details, such as username, login details; and
• CCTV/ BWV camera footage, which may include visual and sound data. This data may capture information relating to criminal convictions and offences or related security measures and information concerning your health, including medical information such as symptoms, illnesses, medicines, treatments, allergies and your medical history .

‍

We also collect, use and share aggregated data such as statistical, analytical or demographic data which is not personal data as it does not directly (or indirectly) reveal your identity. By way of example, we may aggregate data in the following ways:

1. We may aggregate individuals’ usage data relating to use of our website to calculate the percentage of users accessing a specific website feature in order to analyse general trends in how users are interacting with our website to help improve the website and our service offering.
2. We may aggregate data that we collect from our CCTV cameras for analytical purposes. For example, we may use CCTV data for motion detection, vehicle detection, direction of travel, and to analyse certain attributes and key features such as clothing colours, relative person size, and hair colour. Other analytical capabilities may be added from time to time. We shall ensure that any analytical capabilities that we currently use or that we introduce in the future will not include your personal data or be based on protected characteristics.

‍

How we use your personal information

We use your personal information to:

• Provide and personalise our services, including promoting a good experience when browsing our website;
• Deal with your enquiries and requests;
• Comply with legal obligations to which we are subject and cooperate with regulators and law enforcement bodies;
• Notify you of any changes to our website or to our services that may affect you;
• Improve our services;
• Contact you with marketing and offers relating to products and services offered by us, or selected third parties, unless you have opted out of marketing, or we are otherwise prevented by law from doing so;
• Analyse your personal information to form a view which products, services and offers may be of interest to you so that we can then send you relevant marketing communications;
• Personalise the marketing messages and offers we send you to make them more relevant and interesting;
• Allow us to compile statistical information, undertake research and analyse data;
• Carry out site surveys and digital mapping in relation to the King’s Cross Estate;
• Maintain the safety and security of KCCLP, its visitors, staff, residents, agents and others who are on the King’s Cross Estate and their property;
• Prevent and investigate crime or anti-social behaviour; and
• Market, advertise and promote our business and services, including the activities, businesses and retailers operating on the King’s Cross Estate.

‍

Why we can use your personal information

We must have a legal basis to process your personal information. There are various legal bases which we may rely on depending on what personal information we process and why. In most cases the legal basis will be one of the following:

• Performance of a contract with you: Where we need to perform the contract we are about to enter into or have entered into with you, for example to fulfil the terms of a promotion you have entered or to provide you with information you have requested;
• Legal Obligation: Where it is necessary for compliance with a legal obligation that we are subject to. For example, we may need to share your personal information with law enforcement authorities in order to comply with court orders, or other legislation and legal requirements;
• Legitimate Interests: Where it is necessary to conduct our business and pursue our legitimate interests, for example to prevent fraud, report a crime, promote our business, and to enable us to give you the best and most secure customer experience. We make sure we consider and balance any potential impact on you and your rights (both positive and negative) before we process your personal information for our legitimate interests. We do not use your personal information for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law);
• Consent: We rely on consent only where we have obtained your active agreement to use your personal information for a specified purpose, for example if you subscribe to an email newsletter or where we obtain your consent to use photographs which clearly identify you for marketing purposes.
• Vital Interests: Where it is necessary to protect the vital interests of you or others in an emergency. This may include processing your personal information (which may include information about your health) for emergency medical care where you cannot otherwise give consent.

If you require further details on what personal information we collect, how we use it and the legal basis we rely on to support a particular processing operation, please contact us.

‍

Marketing

We would like to send you information about our services, competitions and special offers, which may be of interest to you. Where we have your consent or it is in our legitimate interests to do so, we may do this by post, email, telephone or text message (SMS).

‍

Third-party marketing

We will get your express consent before we share your personal information with any third party for their own direct marketing purposes.

‍

Opting out of marketing

You can ask to stop sending you marketing communications at any time by following the opt-out links within any marketing communication sent to you or by contacting us.

If you opt out of receiving marketing communications, you will still receive service-related communications that are essential for administrative or customer service purposes for example relating to updates to any of our policies and checking that your contact details are correct.

‍

Cookies

For more information about the cookies we use and how to change your cookie preferences, please see kingscross.co.uk/cookies.

‍

Who we share personal information with

We only share data in a way that is proportionate to the purposes explained above and safeguard your data through agreements that we have with all those we share data with.

We may share your personal information with our group companies for business and operational purposes, including the fulfilment of the purpose for which you have contacted us, or we have contacted you.

We may also share your personal information with the following third parties under relevant circumstances:

• Service providers and business partners – we may share your personal information with our service providers and business partners that provide operational and business services to us. For example, we may partner with other companies to optimise our services, send newsletters and marketing emails, provide IT support and management and to analyse information;
• Law enforcement agencies, courts, regulators, government organisations, insurance providers, legal advisors, or other third parties – we may share your personal information with these parties where it is necessary to comply with a legal or regulatory obligation, to enforce our terms and conditions or to protect the rights, property or safety of KCCLP or group companies, our customers or others. This includes disclosing your personal information (including CCTV or BVW video footage) where it is necessary to prevent and investigate a crime, to maintain the safety and security of visitors and property on the King’s Cross Estate, or in relation to any health and safety incidents, or we may be requested to share data about you in these circumstances;
• Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them; and
• Joint venture partners – we may share your personal information with any third party with whom we might jointly own or manage a property located on the King’s Cross Estate or who we might collaborate with from time to time in relation to our business and the services we provide. For example, we may work with partners that sponsor or promote any competition, promotion or survey we run on our website or app or in relation to any activity, event or show taking place on the King’s Cross Estate. We will identify the relevant third party we collaborate with where this is the case.

‍

Where we store and process your personal information

Your personal information is stored and processed by us in the UK but in the future may be transferred to, stored and processed by us outside the UK.

Many of our service providers that carry out certain functions on our behalf are based outside of the UK. When we share data with service providers who operate outside of the UK this may involve transferring personal information outside the UK to countries which have laws that do not provide the same level of data protection as the UK law.

Whenever we transfer your personal information out of the UK, we will ensure that a similar degree of protection is afforded to it by ensuring that at least one of the following safeguards are implemented:

• We will only transfer your personal information to countries that have been deemed by the UK to provide an adequate level of protection for personal information as required by UK law; or
• We may use specific standard contractual terms approved for use in the UK which give the transferred personal information the same protection as it has in the UK. To obtain a copy of these contractual safeguards, please contact us.

‍

Data security

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions, and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

‍

How long we store your personal information for

We will keep your personal information for as long as we have a relationship with you in order to fulfil the purposes we collected it for. Once our relationship with you has come to an end, we will retain your personal information for a period of time that enables us to:

• Maintain business records for analysis and / or for audit or risk management purposes;
• Satisfy any legal, regulatory, tax, accounting or reporting requirements;
• Defend or bring any existing or potential legal claims; and
• Deal with any complaints relating to our business or services.

To determine the appropriate retention period for personal information, we consider the amount, nature and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

CCTV footage is retained for 30 days and BWV footage is retained for 14 days before being erased, overwritten or destroyed under controlled conditions or automatically overwritten as a normal function of the recording equipment unless required to be retained as part of an ongoing investigation of a health and safety incident or a suspected crime or criminal activity or other incident is being investigated.

In some circumstances we will anonymise your personal information (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

‍

Your rights over your personal information

You have a number of rights under data protection laws to control what information you provide to us and what we can do with it.

You have the right to:

• Request access to your personal information (also called a Subject Access Request). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it. We will provide you with this information unless an exemption applies.
• Request correction of your personal information that we hold about you. You can ask us to change information you think is incomplete or inaccurate about you. If you believe that the information we hold about you is wrong, you can ask us to correct it, for example, if we have spelled your name wrong or have an incorrect address. Please contact us at KXG_Data_Protection@kingscross.co.uk. We may not always be able to change or remove that information, but we’ll correct factual inaccuracies and may include your comments in the record to show that you disagree with it.
• Request erasure of your personal information. In certain circumstances you can ask us to delete information we hold about you (the right to be forgotten). This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. For example:
  
  • your personal information is no longer needed for the reason it was collected in the first place;
  • you have removed your consent for us to use your information (and there is no other legal reason for us to use it);
  • there is no legal reason for the use of your information or it is not in our legitimate interests; or
  • deleting the information is a legal requirement.

Note, we cannot always delete your information, for example, if there is a legal reason we need to keep it or where you still expect us to deliver a service to you. We will tell you why we can’t delete what you are asking us to at the time of your request.

• Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) as the legal basis for that particular use of your data (including carrying out profiling based on our legitimate interests). In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your right to object.
• You also have the absolute right to object any time to the processing of your personal information for direct marketing purposes (see opting out of marketing for details of how to object to receiving direct marketing communications).
• Request the transfer of your personal information to you or to a third party. We will provide to you, or a third party you have chosen, your personal information in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
• Withdraw consent at any time where we are relying on consent to process your personal information. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.
• Request restriction of processing of your personal information. This enables you to ask us to suspend the processing of your personal information in one of the following scenarios:
  
  • If you want us to establish the information’s accuracy;
  • Where our use of the information is unlawful but you do not want us to erase it;
  • Where you need us to hold the information even if we no longer require it as you need it to establish, exercise or defend legal claims; or
  • You have objected to our use of your information but we need to verify whether we have overriding legitimate grounds to use it.

If you wish to exercise any of the rights set out above, please contact us.

No fee usually required

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal information (or to exercise any of your other rights). This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Time limit to respond

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Contact us

If you have any questions or concerns about how we collect, use or share your personal information, please contact our Data Protection Officer at: KXG_Data_Protection@kingscross.co.uk.

‍

Complaints

We are committed to working with you to obtain a fair resolution of any request, complaint, or concern about our use of your personal information. If, however, you believe that we have not been able to assist you, you have the right to make a complaint to the ICO, who oversees how businesses and organisations comply with data protection law in the UK:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow Cheshire
SK9 5AF

Tel: 0303 123 1113 / 01625 545745

Email: casework@ico.org.uk
Website: https://ico.org.uk

We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

‍

Changes to this Privacy Policy and your duty to inform us

We may update this Privacy Policy from time to time. When we do, the updated Privacy Policy will be placed on our website.

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your relationship with us, for example a new address or email address.

‍

Third-Party Links

This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.

‍